CVE-2026-103672 HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...

CVE-2026-103672 HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...

CVE-2026-111756

A flaw was found in follow-redirects. When an application provides request headers in an array format, the library fails to remove sensitive credential headers before following a redirect to another host or an insecure protocol. A remote, untrusted server can exploit this flaw by issuing a redire...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756

The follow-redirects Node.js library (versions 1.16.0 to before 1.16.1 ) contains an unauthenticated confidentiality vulnerability where sensitive credential headers are leaked during cross-origin redirects. The root cause is a logic flaw in the removeMatchingHeaders function; while it correctly ...

EUVD-2026-105225

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

npm: follow-redirects array-form headers bypass cross-origin credential stripping

npm: follow-redirects array-form headers bypass cross-origin credential stripping vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, 1.16.1...

GHSA-Q3JH-WRC6-JGQ8 follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

follow-redirects array-form headers bypass cross-origin credential stripping

Summary follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's header...

CVE-2026-89577

A flaw was found in the Linux kernel's device mapper I/O dm-io and RAID1 dm-raid1 components. Incorrect error handling for non-retryable errors such as BLKSTSNOTSUPP and BLKSTSINVAL could lead to misbehavior when a user utilizes unaligned bio vectors on dm-raid1. This misbehavior could potentiall...

Velneo vServer input validation error vulnerability

Versions 36.0 and 37.0 prior to Velneo vServer 36.6 contain an input validation error vulnerability. This vulnerability stems from improper array index validation and may lead to a denial of service...

CVE-2026-94202 Module block-pool create validates two of the four parameter words it reads

The Module Manager's block-pool create dispatcher proved that two ALIGNTYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...

CVE-2026-94202

The Module Manager in ThreadX contains an out-of-bounds read vulnerability within the _txm_module_manager_tx_block_pool_create_dispatch function, located in common_modules/module_manager/inc/txm_module_manager_dispatch.h. The issue arises because the block-pool create dispatcher fails to properly...

CVE-2026-94202 Module block-pool create validates two of the four parameter words it reads

The Module Manager's block-pool create dispatcher proved that two ALIGNTYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-98835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-98848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 clk: Annotate struct clkhwonecelldata with countedby annotated the hws member of 'struct...

Security update for python-joserfc (critical)

openSUSE security update: security update for python-joserfc ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22136-1 Rating: critical References: bsc1285840 Cross-References: CVE-2026-102946 Affected Products: openSUSE Leap 16.0...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46307)

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...